mcp-code-execution-mode
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a container image from 'ghcr.io/elusznik/mcp-code-execution-mode:latest' and installs the 'mcp-code-execution-mode' package from PyPI. While these are well-known services (GitHub Container Registry and PyPI), the account 'elusznik' is not a designated trusted source.
- [DYNAMIC_EXECUTION]: The troubleshooting section provides examples using 'pickle.load()' to persist session state from '/tmp/state.pkl'. The 'pickle' module is inherently unsafe as it can be used to execute arbitrary code during the loading process. If an attacker-controlled process or a compromised tool can write to the temporary state file, it could lead to code execution beyond the agent's intended constraints.
- [COMMAND_EXECUTION]: The skill is explicitly designed to execute arbitrary Python code and provides examples of executing shell commands via 'subprocess.run'. While this is the primary purpose of the skill, it provides a powerful capability that requires strict isolation and user oversight.
- [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting and processing data from external MCP servers (e.g., Slack, GitHub, Filesystem). Malicious instructions embedded in the data retrieved from these servers could potentially influence the Python code the agent chooses to generate and execute.
- [DATA_EXFILTRATION]: By proxying other MCP servers like GitHub and Slack, the skill centralizes access to sensitive tokens and data. This creates a risk where a compromised or misaligned agent could be instructed to exfiltrate data from these services through the provided Python execution environment.
Audit Metadata